CVE DatabaseCVE-2014-8361

Updated 2026-06-17한국어 권고문 →

CVE-2014-83619.8/CRITICALCISA KEV

Realtek SDK Miniigd SOAP Service Remote Code Execution (RCE) Vulnerability (CVE-2014-8361) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

realtek, d-link

Affected Components

sdk, miniigd

Published Date

2015-05-01

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

Mitigation

Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

Affected Products & Version Scope

Wireless routers, access points, IP cameras, and other embedded devices built on the Realtek SDK (including various D-Link models)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest secure firmware updates provided by your device vendor. If CLI access is available, you can download and flash the secure firmware using the following commands:

bash

# Download and flash the secure firmware image from the vendor's official repository
# (Note: Replace the URL with your specific device's official firmware URL)
wget http://updates.router-vendor.com/firmware/v2023_secure_image.bin -O /tmp/firmware.bin
sysupgrade -v /tmp/firmware.bin

2. Temporary Workaround & Hardening Configuration

If patching is not immediately feasible, disable UPnP entirely and block external access to the UPnP SOAP port (TCP 52869) using firewall rules.

bash

# Block external WAN access to the UPnP SOAP port (52869) and SSDP port (1900)
iptables -A INPUT -p tcp --dport 52869 -j DROP
iptables -A INPUT -p udp --dport 1900 -j DROP

# Terminate the miniigd process to stop the vulnerable service immediately
killall -9 miniigd

3. Log Audit & IoC Verification Commands

Inspect the running processes and system logs to identify potential exploitation attempts or active compromises.

bash

# Check if the miniigd process is currently running on the device
ps | grep miniigd

# Search system and web server logs for suspicious NewInternalClient payloads or shell commands
grep -i 'NewInternalClient' /var/log/messages 2>/dev/null
grep -E '(/bin/sh|wget|curl|chmod)' /var/log/httpd_error.log 2>/dev/null

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As an actively exploited CISA KEV vulnerability, immediately disable WAN-facing UPnP services and apply the latest vendor firmware updates.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the miniigd (Mini IGD SOAP service) daemon, which is part of the Realtek SDK used in various embedded devices. The miniigd service processes XML-based SOAP requests for device management and port mapping. The root cause of the vulnerability is the lack of proper input validation and sanitization of the NewInternalClient element within SOAP requests. This allows attackers to inject shell metacharacters that are subsequently executed by the system.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a specially crafted HTTP POST request to the UPnP SOAP service port (typically TCP port 52869). The payload targets the AddPortMapping action, embedding shell commands inside the NewInternalClient parameter using backticks (` `) or semicolons (;). Because the miniigd daemon passes this parameter directly to a system command execution function (such as system() or popen()`) without validation, the injected commands run immediately with root privileges. This vulnerability has been actively exploited in the wild by IoT botnets like Mirai and Gafgyt to recruit vulnerable routers into DDoS networks.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat to network infrastructure. Successful exploitation allows attackers to establish a persistent foothold within the local network, facilitate lateral movement, perform Man-in-the-Middle (MitM) attacks, or redirect user traffic via DNS hijacking, severely compromising business data and network integrity.

Official Vendor Advisories & References

NVD Original English Description

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

http://jvn.jp/en/jp/JVN47580234/index.html

Source: cve@mitre.org · Third Party Advisory

http://jvn.jp/en/jp/JVN67456944/index.html

Source: cve@mitre.org · Third Party Advisory

http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html

Source: cve@mitre.org · Third Party Advisory, VDB Entry

http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055

Source: cve@mitre.org · Vendor Advisory

http://www.securityfocus.com/bid/74330

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

http://www.zerodayinitiative.com/advisories/ZDI-15-155/

Source: cve@mitre.org · Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2014-8361)

FAQ

Q1. How critical is CVE-2014-8361 and is it actively exploited in the wild?

CVE-2014-8361 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2014-8361?

Primary impacted vendors include realtek, d-link across sdk, miniigd. Scope summary: Wireless routers, access points, IP cameras, and other embedded devices built on the Realtek SDK (including various D-Link models)

Q3. What temporary mitigations or workarounds exist for CVE-2014-8361 before patching?

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION